SkillSpector

What it does

SkillSpector is NVIDIA's scanner for agent skills and MCP packages. Point it at a Git repository, a URL, a zip, a folder or a single SKILL.md and it runs 71 checks in 17 groups, covering things like prompt injection, data exfiltration, privilege escalation, supply-chain problems, dangerous code, YARA signatures and MCP tool poisoning. You get back a 0 to 100 risk score, a severity and a recommendation.

The MCP side is small. Start it with skillspector mcp and your agent gets a single tool, scan_skill, which it can call before it installs a skill or another server and then act on the answer. The verdict says whether the LLM pass actually ran. That matters, because the semantic pass needs a provider you set up yourself (NVIDIA Build is the default, and OpenAI, Anthropic, Bedrock, Gemini, Ollama, any OpenAI-compatible gateway or a local claude, gemini or opencode CLI also work). Without one, only the static checks run. Known CVEs in dependencies are looked up live on OSV.dev, with an offline fallback.

One detail from the code is worth knowing. In mcp_server.py, safe_to_install is true only when the score is 50 or lower, every file was inspected, and the LLM pass finished whenever use_llm was left on. So with no working provider and the default use_llm=true, a clean static scan still comes back with safe_to_install false, and a SAFE recommendation is lowered to CAUTION. Pass use_llm=false if a static-only verdict is what you want.

There is no PyPI package. The docs install it straight from the Git repository with uv and the mcp extra, so you get whatever is on the main branch.

What it needs

Install with uv tool install 'skillspector[mcp] @ git+https://github.com/NVIDIA/skillspector.git'. The plain CLI install leaves out the mcp extra, and skillspector mcp then stops with an error asking for it, so reinstall with --force if you already have the CLI. For LLM analysis set SKILLSPECTOR_PROVIDER and that provider's key before the client starts the server.

Limits

• Limit With use_llm left at its default of true and no working LLM provider, safe_to_install is false and SAFE is lowered to CAUTION, per mcp_server.py.
• Limit Over the HTTP transport, local paths, file:// URLs and https URLs carrying credentials are refused. Use stdio for private repositories.
• Limit The HTTP transport has no authentication and binds only to 127.0.0.1 or ::1. Remote use needs your own authenticating reverse proxy.
• Early release The README says the initialize hang reported in issue #199 still applies to the stdio transport.
• Not covered scan_skill scans one target per call. Recursive collection scans with --recursive and --max-skills (32 skills by default) are CLI-only.
• Size cap A scan stops at an overall deadline of 1080 seconds by default, set with SKILLSPECTOR_MAX_WORKFLOW_SECONDS.
• Limit The codex_cli provider is disabled. The opencode_cli provider is verified against OpenCode 1.18.31 to 1.18.35 and 1.19.0 to 1.19.4.
• Cost Hosted LLM providers bill per token on your own account. Static checks and Ollama cost nothing.

Who it suits

Suits anyone who lets a coding agent such as Claude Code, Codex CLI or Gemini CLI pull in skills or MCP servers and wants a check in front of each install. It runs on your machine, only reads what it scans, and works without any account in static-only mode, although the full verdict needs an LLM provider you pay for or run locally. For scanning a whole folder of skills or for CI gates, the skillspector CLI does more than the MCP tool, with recursive scans, SARIF output and baselines. It is NVIDIA's own scanner and does not stand for any of the products whose skills it checks.